Configure SAML single sign-on with Okta

1. Log in to the Administration page on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down list, select SAML.
4. Click Continue.
5. Click View SP Metadata. You will need to copy the ACS URL and Entity ID to paste into the Okta configuration in the next procedure.

This procedure requires you to copy and paste information between the ExtraHop Admin UI and the Okta Classic UI, so it is helpful to have each UI open side-by-side.

1. Log in to Okta.
2. In the upper-right corner of the page, change the view from Developer Console to Classic UI.
   
3. From the top menu, click Applications.
4. Click Add Application.
5. Click Create New App.
6. From the Platform drop-down list, select Web.
7. For the Sign on method, select SAML 2.0.
8. Click Create.
9. In the General Settings section, type a unique name in the App name field to identify the ExtraHop system.
10. (Optional): Configure the App logo and App visibility fields as required for your environment.
11. Click Next.
12. In the SAML Settings sections, paste the Assertion Consumer Service (ACS) URL from the ExtraHop system into the Single sign on URL field in Okta.

    Note:

    You might need to manually edit the ACS URL if the URL contains an unreachable hostname, such as the default appliance hostname "extrahop". We recommend that you specify the fully qualified domain name for the ExtraHop appliance in the URL.

13. Paste the SP Entity ID from the ExtraHop system into the Audience URI (SP Entity ID) field in Okta.
14. From the Name ID format drop-down list, select Persistent.
15. From the Application username drop-down list, select a username format.
16. In the Attribute Statements section, add the following statements exactly as shown. The first four attributes are required. The user.packetsLevel and user.detectionsAccessLevel attributes are optional. If you have a Trace appliance and you do not configure the user.packetsLevel attribute, users will be unable to view or download packet captures in the ExtraHop Web UI.

    Name	Name format	Value
    urn:oid:0.9.2342.19200300.100.1.3	URI Reference	user.email
    urn:oid:2.5.4.4	URI Reference	user.lastName
    urn:oid:2.5.4.42	URI Reference	user.firstName
    urn:extrahop:saml:2.0:writelevel	URI Reference	user.writeLevel
    urn:extrahop:saml:2.0:packetslevel	URI Reference	user.packetsLevel
    urn:extrahop:saml:2.0:detectionsaccesslevel	URI Reference	user.detectionsAccessLevel

    The following figure shows a completed example.

    
    
    
17. Click Next and then click Finish.
    You are returned to the Sign On settings page.
18. In the Settings section, click View Setup Instructions.
    A new browser window opens and displays information that is required to configure the ExtraHop system.

1. Return to the Admin UI on the ExtraHop system. Close the Service Provider metadata window if it is still open, and then click Add Identity Provider.
2. Type a unique name in the Provider Name field. This name appears on the ExtraHop system login page.
   
   
   
3. From Okta, copy the Identity provider single sign-on URL and paste into the SSO URL field on the ExtraHop system.
4. From Okta, copy the Identity Provider Issuer URL and paste into the Entity ID field on the ExtraHop system.
5. From Okta, copy the X.509 certificate and paste into the Signing Certificate field on the ExtraHop system.
6. Choose how you would like to provision users from one of the following options.
   • Select Auto-provision users to create a new remote SAML user account on the ExtraHop system when the user first logs in to the appliance.
   • Clear the Auto-provision users checkbox and manually configure new remote users through the ExtraHop Admin UI or REST API. Access and privilege levels are determined by the user configuration in Okta.
7. The Enable this identity provider option is selected by default and allows users to log in to the ExtraHop system. To prevent users from logging in, clear the checkbox.
8. Click Save.
9. Save the Running Config.

1. From the Directory menu, select People.
2. Click the name of the user.
3. Click Assign Applications.
4. Locate the name of the application you configured for the ExtraHop system and click Assign.
5. Confirm the email address in the User Name field and then click Save and Go Back.
6. Click Done.
7. Click Profile.
8. Click Edit.
9. In the Write Level field, type one of the following user types:
   • unlimited
   • full_write
   • limited_write
   • personal_write
   • full_readonly
   • restricted_readonly
   For information about user privileges, see Users and user groups.
10. (Optional): If you configured the user.packetsLevel attribute in the first procedure, configure the Packets Level field by typing one of the following user types:
    • full
    • full_with_keys
    • none
11. (Optional): If you configured the user.detectionsAccessLevel attribute in the first procedure, type one of the following access types in the Detections Access Level field:
    • full
    • none
    
12. Click Save.
    Users must have an active Okta account with a valid password before they can log in to the ExtraHop system.

1. Open a new browser window and enter the URL of the ExtraHop Web UI.
2. Click Log in with <provider name>.
3. Sign into your provider with your email address and password. You are automatically directed to the ExtraHop Dashboards page.